medusalocker | hxxp://google[.]com

Resubmissions

02/10/2025, 13:15

251002-qhatsacr2w4

02/10/2025, 13:05

251002-qbzvbscq3110

Analysis

max time kernel
451s
max time network
452s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
02/10/2025, 13:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample251002-qbzvbscq31

Score

10^/10

defense_evasion discovery medusalocker ransomware spyware stealer trojan

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">8F24D08508B37C9F215BF2DDE2AB5735729FC07578889409C51293004F484197B82CD2195D96C3277E8CA6F8621E52E35E28FA12A6162F139E2C32C28B76CBB5<br>6EA32532A39ACBAD07AE9327609E89A36661DFB1BBC8E6D590C7BD3A11E5B87CF66D7F39F7DFFC7CA3C7726D3954E6D4AEDD3E866508F70BE76E15E280CC<br>76558ACD41D1D857E7C3D6096AE0EBEB9D7D39934820975FC7E1DFD32481375823272DD9296837F9F513DBC7522D7F3642276648738F093D8AB98F0A91AA<br>978C4BC1C50A3EF05157D556EFE95CD3FF350F411639737A004A41EC7116401A84EBC7296E548B6A1EBC92C2086F726B34DA1F041775692A255C91A1BB89<br>17E15E3B5282A90232ED4F22A50B0C78770A6E6B7CDD4D041CA67E590719F506091EBC7B12D6D379EA203019D50D3C36186904C612DC22897C8959ECC2A4<br>81C919B35877BE55528698460D9272E44CA70872CD7B93D91ACCCBA6136A9BA5744EDAC6D09C8DF15992330A19A81C86025F042D5DFB94059DEE88727E8E<br>D8A80EC8BA0FD4D24F06E149F6C87326BB0F73639366218EC1BD513A876519CBE00890AFE10362307DDFB3C4195FA5DE502D505477CFD89A8D9294827053<br>925B9990FD51C3D38AE8EB52AF98F3DC4A737140C3B7E429D785FCE3A462D19B09CCA30E21AD253B072E9A13B7380CB6BA896E81C3AC18E8501CC6A4A307<br>E402AD966EEBB0704D2EE4478413</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a></a><br> <br><br> Follow the instructions to open the link:<br> <br> <br> <a><br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

Signatures

MedusaLocker
Ransomware with several variants first seen in September 2019.
ransomware medusalocker

MedusaLocker payload 8 IoCs

resource	yara_rule
behavioral1/memory/1268-4647-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/1268-4648-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/1268-4675-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/1268-4678-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/1268-4707-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/1268-4786-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/1268-4805-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/176-4806-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker

Medusalocker family
medusalocker

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe

Renames multiple (218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
176	svhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-3625340254-1625357543-1797847221-1000\desktop.ini	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\X:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\A:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\E:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\H:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\N:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\P:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\S:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\T:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\K:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\W:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\Y:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\F:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\Q:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\B:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\G:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\O:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\V:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\Z:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\I:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\J:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\L:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\M:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\R:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
285	raw.githubusercontent.com
283	camo.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1623233322\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_9846004\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1935291319\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1935291319\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_9846004\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_94941014\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1610491432\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_9846004\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1935291319\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1610491432\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1623233322\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_9846004\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1610491432\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1610491432\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_94941014\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1041538912\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_9846004\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1041538912\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping804_1706752829\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1610491432\sets.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134038839668965347"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3625340254-1625357543-1797847221-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3625340254-1625357543-1797847221-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3625340254-1625357543-1797847221-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3625340254-1625357543-1797847221-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3625340254-1625357543-1797847221-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3625340254-1625357543-1797847221-1000\{33E66713-1735-4574-AF04-F71482926228}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3625340254-1625357543-1797847221-1000\{32EBEB2E-142A-43AE-8B98-BA5BF6E46808}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\5aa774e9545c8b8ce704219aeb374be885ec8533eaa8562db4ad5118917582be.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3512	chrome.exe
3512	chrome.exe
5252	msedge.exe
5252	msedge.exe
3512	chrome.exe
3512	chrome.exe
2448	msedge.exe
2448	msedge.exe
2336	chrome.exe
2336	chrome.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
1268	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
5252	msedge.exe
5252	msedge.exe
5252	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
4924	7zG.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
5252	msedge.exe
5252	msedge.exe
5252	msedge.exe
5252	msedge.exe
5252	msedge.exe
5252	msedge.exe
5252	msedge.exe
5252	msedge.exe
5252	msedge.exe
5252	msedge.exe
5252	msedge.exe
5252	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1016	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2044	804	msedge.exe	78
PID 804 wrote to memory of 2044	804	msedge.exe	78
PID 804 wrote to memory of 3868	804	msedge.exe	79
PID 804 wrote to memory of 3868	804	msedge.exe	79
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2420	804	msedge.exe	81
PID 804 wrote to memory of 2472	804	msedge.exe	80
PID 804 wrote to memory of 2472	804	msedge.exe	80
PID 804 wrote to memory of 2472	804	msedge.exe	80
PID 804 wrote to memory of 2472	804	msedge.exe	80
PID 804 wrote to memory of 2472	804	msedge.exe	80

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ffea476f208,0x7ffea476f214,0x7ffea476f220
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1664,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2168,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2436,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:13
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3396,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3412,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4760,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3800,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5024,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5032,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
  2⤵
  PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5952,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5952,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6052,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5820,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6388,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6032,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4964,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6536,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3112,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:2
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6904,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7148,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7196,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6688,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:14
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6908,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2072,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:12
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=5284,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=4580,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=7368,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7568,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:14
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=7796,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=7400,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2720,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=8072 /prefetch:14
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5124,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:10
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8640,i,15286006615159423597,3936319271872503492,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of SendNotifyMessage
  PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ffea476f208,0x7ffea476f214,0x7ffea476f220
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1636,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2148,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2500,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4364,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4364,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4228,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4576,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
    3⤵
    PID:652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4552,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4484,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4996,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2488,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:14
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2940,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2692,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:14
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5168,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4648,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4896,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4088,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=1960,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6128,i,10347642606781524935,8813104281665057188,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
    3⤵
    PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4772

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004C8
1⤵
PID:1088

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffea3d7dcf8,0x7ffea3d7dd04,0x7ffea3d7dd10
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1912,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2252,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2276 /prefetch:11
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2372,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3220,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3272,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4180,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4200 /prefetch:9
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4596,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5296,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5536,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5312,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5308,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5604,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5328 /prefetch:14
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5348,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5704,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3336,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2256 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=220,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3456 /prefetch:14
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3680,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3692 /prefetch:14
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3664,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3480 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5752,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4756 /prefetch:9
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4628,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5672,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5592,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3464,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4612 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6016,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  - NTFS ADS
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5812,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6208,i,10391916961663676545,104346048079266172,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3456 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1580

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3148

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334\" -ad -an -ai#7zMap8430:190:7zEvent15216
1⤵
- Suspicious use of FindShellTrayWindow
PID:4924

C:\Users\Admin\Downloads\183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334\183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
"C:\Users\Admin\Downloads\183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334\183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:1268
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4460
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5788
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\how_to_back_files.html
1⤵
PID:5284

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0089467a20f370207f0a84e7ef4b92b3088dc21d0643209645c2aec6e8cf8034
MD5 d2c9779b3580c994fbd7fbd38ccb90b2
SHA1 955cdd00b8cc67b547a06b420752a768c134ebf7
SHA512 0d1aa202da1b78a7c8a5b8af15848b81175d0228d137a0aff74138f331b75adb81982e973507c0998816f00941cefdcd48b79d89a50a78bff001eb709d5010f6
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 340KB
SHA256 e6665f6ae7b074dd4a0e72994e4a2ab67226703aa6dcb5f9257adab406d337e8
MD5 12c758b2a028864927a0b4d201b8e56c
SHA1 08cca685485f673b84042bb0899bed5eb8f9586e
SHA512 8270cf9254d7875c344ab4356fc8d2aba1a8b1e7c128a110074a06e4516d964b2cb254012fad8c07b6cf3b96e1c7b77390753ccc62a830180beee67189ca4532
SSDEEP 6144:ixZ/9T3PvOVHpKEDk4ji8tfuvnManBG80xhKZdvhutB7OIFNcgHUfT:W/9bOVJKEz3tfuUaBG80uYz7VcNfT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 77KB
SHA256 18c9f470c470b415bc36406461ca3ec6dcdf965a1fe0105f49a8b38a8bfea04c
MD5 730c87fe964e01a824c7689c4868ade3
SHA1 881400b6888d4fe9c4edf1e8dc431cc69747e706
SHA512 c218344ed1290d733f7be3e20e90cfa6f9b5bad490ed595d8c971c0b86df15386f8d4774db902ef415f1559f5ee20645ca1bc899104002c1ccf57a9926ad79b1
SSDEEP 1536:x9r1PtnMBLA3JJgTLdcxDBiFLte9PwlyCgDEZsnh0:znMBg7g3yF8psYlyCgDECh0
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a2aecdb9b3e6ee81c674f8c5f2f9a41565bdac22f5d3a500f72e029cf239fb15
MD5 b84411ccf2e77e4189d81b136582e856
SHA1 bfb8e73cde3282f9fc4725a0f4bf953f94814696
SHA512 de8e5b58bb73edb0614b7c326ff184e6ea6700c5522d06fb50c91f609b9eaf8d65855e1226a019a39e5945af56f6679d9eb3107387408a57fb7576245219a28f
SSDEEP 96:XnP7c1VtjzqnDJq9v737i/z4ElBba5bpk:Xzc1VtjzqncBC/z/eq
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6749a3a99fc22e245559d71e2d04f16829a4af2916d43356e26f8f9630fcf7b3
MD5 9ac38d01e08fb7195d4c7b861d035b04
SHA1 1bb5344f525197bd64eabf8e67b10319c4140a08
SHA512 ce20e5e63187bf14bac563bc955c705dafd53500bc3f2fa4364838a073ad3b70d10d82183cbf85dbd89ffd767fe42a83ddb253c78bdc83ff80f05623954b2f93
SSDEEP 96:YnP7c1VtYzqnDJq9v737i/z4ElBba5bp5:Yzc1VtYzqncBC/z/e7
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.96.1_0\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.96.1_0\_locales\en_US\messages.json
Size 1KB
SHA256 102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1
MD5 578215fbb8c12cb7e6cd73fbd16ec994
SHA1 9471d71fa6d82ce1863b74e24237ad4fd9477187
SHA512 e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 8c2ce50d1fcb23789e27923bfcd90941edb2119efa2767a6351bda9335934b71
MD5 654f072c8291e7f96ffd36e6e96d1901
SHA1 7ea08503d3d4c3119eb6625e092c5e57d3415f79
SHA512 563bfff2606cdc4cc2f5792fe6a403fe9ee1eaca89a0a4348e5d61dca63462358b78d44b4fc0aa0329325cfc2227448ce894c662e5fc66f2930b3b2785cd9571
SSDEEP 192:DnIJzmdVO+j9s3RxikRmSmnmKm0mJm3mhHJELpaxrugQFubWc:DnIJzmdVO+j9s3RxikRmSmnmKm0mJm3m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 c517d14ad92de636ca0a6951dde824b36381ea15b68778b63a7acd87e037473c
MD5 46ae2da589ac7385d1a8a81bb68678c4
SHA1 9ec402aa4d5b746be4f8b52d1aad7e2ef0929ad6
SHA512 0d3b7779efdf8a315a1da30cd0838d6b400b3723af298407192332e071f79a42fdffc9f1c3f5258495cb1309e98ce382c136ce1b5a6dd67dc3d8cae97a0f998e
SSDEEP 192:DnIJzmlO+j9s3RxikFumSmnmKm0mJm3mhHJE6RpaxrugeUF2:DnIJzmlO+j9s3RxikFumSmnmKm0mJm3C
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c41c325d0ff5c889bd96fd0ade5bcb95bebf2c8766a6c5033bbb854b6a6116c0
MD5 2a9308186c0e009df2305908ffd6b9e3
SHA1 bb90b403a75007e99dd78ada4ed1d47d3d1844dd
SHA512 3b600352a36417d23cf5e8ec66ce0845e5457207ae000c863c9bb04466d6b9f02ea03b5c66cd0e4a320330d5261eedcf410eece313344d2fef7dcca92b40a8cb
SSDEEP 96:DnIJzmlO+j9s3RxiTzLZxmXBmD4eV4dW4Ymnm3mS+m0m22:DnIJzmlO+j9s3RxiTzLZxmxmD/Ppmnmz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a654ccdb05fce394945eec9324ccfc058929c34ea205adf8f4553cb1a1767609
MD5 320257ba9042cfa5b4e5fc92e14e78a1
SHA1 b9f03639f32c22fc4852c5b7019e50ee224fbb4b
SHA512 c75f0b1654e6826230d87c825c15d3aa380f18bdf48f91486f3c6c8cf6a4501917b8b344b42e00bcdd74e872d61c7eb43d70366ad6edcf05793170a9360ea8c5
SSDEEP 192:hY9rcBzKRHq8szUZ8PRpLJTPGNHS+WNZZgW4QG+/U3eqrS2+f+pQyIsnA/g2:hY9rmzKtAXg9c5K+0rS2Y4Z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d564ee683ca39205eff0d22d978e1a7042c77635ce9c80859132a620307ca4e4
MD5 d5e8cb38607c016717dd4ac331e73410
SHA1 a92b89dbdd0e48f8d59ec2e2e1662b128ba09250
SHA512 e8858ed5c7f4f3ceb5ba533671a76da91eaa88bb29cc32010ffa7f2490025b3bc4bd10519571dcc84d3427ab3c99077b89f1225784d659135ea86f2140ebee47
SSDEEP 192:hY9rcBzKRHq8sOUZ8PRpLJTuGNHS+WNZZgWvGE+QG+/D3eqrS2+j+pQyIsnA/g2:hY9rmzKt3Xl9c5dA+PrS2q4Z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0a2a74f3ada60d5c961b96b7753ded21245006ed2ce4f60b617e03b536a24941
MD5 0827c98db82019fac4fa7b3a8a969196
SHA1 0a607c7d1c57bb488d3bff6e61c51a7c16b7899c
SHA512 098d44fb58668444f23eb2bd696b074178d79681242698a7d3a586ea7af3e506fc3c1888d767a326814cc0d0a396559b967920981ee695a0bdfa4c1fe476efc9
SSDEEP 192:hY9XKRHq8s6UZ8PRptADNHS+WN4gW4QG+/i3eqrS2+i+pQyIsnA/g4:hY9XKt3XS9cSK+erS2V4Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4e3cec903b8cf32cc7d2edb0184620abdbb10941aeb92c7a82eb650ba7f5841e
MD5 c22834ed952975ab92607e5a0b033fd0
SHA1 388e3ab3169f8d7059954284040b6e06c4697fde
SHA512 12b990405f7abc25cf106ce31480f4279f11c01e71d16188ff8b237b1183787c366c52fddef1012b4318823782b1f7c8ec946a4f610019d2f0030a6988495554
SSDEEP 192:hY9rcBzKRHq8saUZ8PRpLJT3GNHS+WNZZgW4QG+/i3eqrS2+i+pQyIsnA/g4:hY9rmzKt/XU9c5K+erS2V4Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6a636f6c7aed1ea3d89302170eb631ce061bc2deec7bfced1c4ed1150cfe4353
MD5 b2ed8352f2927ad3aa461353271b6cc8
SHA1 3a91e1e757e960b17ee0f6a96d6d2836d5c4e008
SHA512 225c11c070b2d481d76bde1e7f9be7ddc4836cad84f243685aa74ccbeaabba16281e89547ccce319d4b546ea21ba09e83f2469951f474e7d7193f50490f79585
SSDEEP 192:hY9rcBzKRHq8suUZ8PRpLJTuGNHS+WNZZgW4QG+/U3eqrS2+f+pQyIsnA/g2:hY9rmzKtTXl9c5K+0rS2Y4Z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 87cb5b55f3fbf1adc87d895f7951d0c8977f92819ee4b55f7ceb012bd01d4129
MD5 cfd20908526ccfef80daca2d4c1f84c2
SHA1 21032018ada76901d112adbe5685a66599cc05d7
SHA512 f101149ab0998f2e5874f1dbaa14a15030a48bbd41f5ac2fdc8b74ba39a79086dfe138dde4e77a30d3b068f5b071335d7a4e90b0ad47c914df01062d09468f8f
SSDEEP 192:hY9rcBzKRHq8sXUZ8PRpLJ3seeNHS+WN7E3gWvWd+QG+/a3eqrS2+j+pQyIsnA/p:hY9rmzKtMXC9cs4A+WrS2q4Z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b83c24b32c23f340347a632c5f7bc96a070aaa143c1c878839828aed1a735cb7
MD5 b47290bf633a60a318ea1925304d4bc1
SHA1 013b9d65b9169abf9d9c13f11e96290cb9a426ac
SHA512 93ab594a33281078189165a586eb14d5109093210ee2a6b791ba79f0f337e2668fffd597a40bd58dc9fcdd6b300b1d9a01e30f4dfb2477941b4153abc5639e7f
SSDEEP 192:hY9rcBzKRHq8s5UZ8PRpLJ3aeeNHS+WN7E3gWZdq7Wd+QG+/w3eqrS2+j+pfyIsA:hY9rmzKt2XQ9csmcA+ArS2q4g2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 69e293c77a5930b380f496845b9b19e25404d25c37648ac8b96867f0df4d5a7e
MD5 8fe41278c52fa2451bb98eeecf033987
SHA1 b0fd08adc2572d9d2297226ba0c129fe3687dae4
SHA512 6042ae9b5a60a924c41a82f1c79f05eb2b50f2524bd1e9d7a0ba9b04d3d8697cad5e96d8d4115e878b26efac3d06a3d94931edc86fe5d673c7035a0fee19d9da
SSDEEP 192:hY9rcBzkRHq8sKUZ8PRpLJ3oeeNHS+WN7E3gWZdq7Wd+QG+/w3eqrS2+j+pfyIsA:hY9rmzktvXy9csmcA+ArS2q4g2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8e6a801b7450cd92076cc79b5535d8b79909d5fd3f8a459bf0d0a628f710b2be
MD5 08c4da2300859064109bdffe71d4a101
SHA1 f3c48455e3b9e71ceb4c3545fd9937303d55972f
SHA512 4a4379eaa045de8e9f874efde6964ae0656b55420e2ab6b637efc7a8cc6fc980505f63675ee58d9c3f10eee73451b6a2cb4355ec8a651f9c98b0e77c1c7fd69d
SSDEEP 192:hY9rcBzKRHq8s2UZ8PRpLJ3aeeNHS+WN7E3gWZ6G3dWd+QG+/xW3eqrS2+j+pQyi:hY9rmzKtbXQ9csge2A+JKrS2q4Z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f129a768cc557929f40101cfebaa8ab03494a56daa5375919d811679b30ddf7f
MD5 58e76db18388c4782107eb8091b2b730
SHA1 7d798a5eff2599f6e0b57e4549b319dd87a36760
SHA512 366c47bda930733088ccb7cd02e12dd43bdfa0424b56429e8f378f6f38a87ae9ffce3df3f49e457a4a4498ae26b1c90e0abdb5dc59ce9f35085eac0a86758aec
SSDEEP 192:hY9rcBzkRHq8syUZ8PRpLJ3NAeeNHS+WN7E3gWZxGcUWd+QG+/o3eqrS2+j+pfyi:hY9rmzktnXA9cs+AA+orS2q4g2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a1f3fcb1725c24993de5684940808e80356297423fcf55462ddfa08d49d3fd66
MD5 8ba39157d653e547cec182b5087ae35f
SHA1 1f77c706817807750f1f428ecdfe19478daa0705
SHA512 431dd1489b2dbe33b7507a0944c0300774c0016c4cfe097df76bc9f1424919365d8c5eb3616dd56dbcb413ff291a95602a678760e9421bfc9a15a2235322e933
SSDEEP 192:hY9rcBzDRHq8syUZ8PRpLJ3heeNHS+WN7E3gWZGr9Wd+QG+/bX3eqrS2+j+pfyIB:hY9rmzDtnXr9csuWA+jLrS2q4g2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ff331045968662b1cd28efd0db11ae805f3f7f301723ab393cb6c67611a1dd9d
MD5 b04a27204cfefd4170918b7df8176a7d
SHA1 f8d4727765d218110abc078eee51792575de9c7e
SHA512 58727ee34b9d7098f5e44b9cfd1497d9e58d649f757b4b6dca65e009eb1f517d3a191b26d967f676d30a7bd67cb014779b5bd99b82894992c7397c77051e1e3b
SSDEEP 192:hY9rcBzKRHq8sKUZ8PRpLJ3VMeeNHS+WN7E3gWZdq7Wd+QG+/w3eqrS2+j+pfyIB:hY9rmzKtvXA9csmcA+ArS2q4g2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 18KB
SHA256 92654775343b2959d6d1bae11fe20893a9caaa004032d30d3d682cbd94af99db
MD5 9c4596afe3ca0208c4cbdc5769e7213e
SHA1 be2e7f478ec85b788cd0c74d5d9d53a76c423c0e
SHA512 293a1ecb11db2a697951f692cc4aab3515a2fde36113b756be485c3a87523fbcb8d2d7452caf08c6c1f81a9c17a9009bdca504e7d96abdbd35f8f298d3088ee7
SSDEEP 384:bjjY7pLuLcBP7pLuLceizCXZePkXqKf/pUZNCgVLH2Hf13irUz+HGG+nBg4:bnY7pLuLuP7pLuL76QZePkXqKf/pUZNW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 54caac14def106c23a3c0aee75184c7bbfac1b3e513b1bbf767adf592dea00f9
MD5 e715d3d4112dea70aee413ac993907d5
SHA1 b16c37e4c509eaa437ca10e41dbd82fb30e5118d
SHA512 5960a3812d2cb8008d797e31014194096305a4f5de5deda63044c29f44a301bf1302068f2178bed656b9ef9cbe0724dfd61c3de69ed2c2aa464d2eac7bceb5ff
SSDEEP 384:bjA+7pLuLco9zCXZePkXqKf/pUZNCgVLH2Hf13irUz+HGGWjnBgef:bE+7pLuLhJQZePkXqKf/pUZNCgVLH2Hp
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4e00b2126bb29af7119dea264d46360feb565255bf9b7093de2b35265ed485c6
MD5 a6432175dd13e154b951278aa8ae1e71
SHA1 c889cc3a49e65e3db51c2556071072356186664e
SHA512 3cc556738ac723aa40aa8784a8ed0fb40ad98715413dc0d1134da1862d19ebe3a2f5a7b277bbdcbb1180eebbb87d0323364f56d7500fe731b4bca52d5a77a253
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 482bdf7b380ac8bff38cd9cc65734f0829f5cb8cf74d43ec54b58fb902bd3acf
MD5 a3edc0afd8dd51a2c58a54a75820b321
SHA1 c62ece3c539b7ab96f9a2773557884484352d799
SHA512 b8056c898ee1c2e7c5f002acf94ed85d4c4944ec26547d315f22329b806990912460ac2b8a2368600760395d852f9f30185731c460c25d34dcb34e3daf881ccf
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5b5475.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b5475.TMP
Size 48B
SHA256 a0dd4b0c8a241b43fbd3a46f98ad21a34772a95680e97e6f79df5b02134b5351
MD5 8168c0c37d36fd1164fb9d6cf090979a
SHA1 38adddc10805ff269e0c3e3259e4a03ddb61c261
SHA512 6c8f6bc98157eeffa85df4b582e4b3122cba1a46db56b4c0f2fc55a5ba14ce302db403859edfe489d4bf48d9e07523f4f3deee0429d33b385da4b0e4fa4ca9ce
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\f_000003
Size 16KB
SHA256 41176fbc6675b854d302b68d77737882d6556f94f605d34e7366c428512f05e0
MD5 f4dbdf2d1995ca841cbe55b69abca97e
SHA1 5dfc7b29b40a4631754b6119e1559f445ccd6d31
SHA512 4d2c7b81139050d92224023e6e6a23a7a6fb3b4c2dd8156beb704e102b1a3d902add2df1dea4fa0df42ad722fb4eee000f3dff5c6e6c9a3996342f181c57c886
SSDEEP 192:SmorT8mWFa+xEzAlZSlHCOmHbrDYZyoYY1zf68rIJ1keg3ERFTHkYicr/UDTNcx6:SMPzZsRrIYI9jhY
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\f_000006
Size 16KB
SHA256 1f502a207e7f2c79888d5506a426c17531047a498d1b63562fd2c7bbd565abdf
MD5 8b31d76538081bfbf3c65f45d3fc9512
SHA1 09945fc6cd6b34593de8cffb99c55df9df876df6
SHA512 e236b54e02e4ffc2a25aa73c02237a2761f6660897072b03f349579408ef9ef1098377d534b18a6e23f57d3ebcc460b420a10dcb7f0facbe229b6acbdd245230
SSDEEP 192:s/F7cTwVVL++xEdZhI1u/TbjolVRoes+T3XF1ZJ8UEE0CARoLz1EI9MDI6nw/+eu:c/EhIZnw+ARoqI9MbDe5GmR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\f_00001c
Size 18KB
SHA256 8b8509016a6393e9efe9cfa25f1387dae0cdd8dc7b6fb51efecbd98c1d73ed1b
MD5 aaaddeb4290d2d5fe2e5a395fd41b0e5
SHA1 9884756f63123ff26bcf81092cc674a65402ad07
SHA512 4274a60f31f514f1c4e22f192209bbe5dc8affc7b6a6aa130a46bf70bbc5d94ca8fe49f44ddabec0c6eeae839ed977cf2c3d5fc63b24c82ea834e765f2721c5c
SSDEEP 192:9xUp7ITwVOUs5jr+xEtK9qhIPJ/DCd7r7VP7VH1aJ8U+E0CpUbMbmnDjsNKc0KHV:HC9qhIKVP33+WbMbmnDjsEKlIUDoya
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 0f2fb20af70804cd2d726bf0b41070c5b9926fe8bc7b2784a95a8f4f95585888
MD5 6a947e87f2e1f14d384a6d8d9a391705
SHA1 9b8b82f98258e67056ecc6204e9c9ed82adc6910
SHA512 def8ba2a05ffd43ccabf0e9f5c03201061d60bdff11196099ccfd49f4ff06ddb22be8a9674a08236a149b2c3ddace2bc8d818d054a2c9befd4fa9919ca3c103c
SSDEEP 1536:qyMFRXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMl:nORXjM4rTmN5eWvStRNoV8cWK7XF+Tw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 183KB
SHA256 d8214f0a57b6f8bfa9eac034b568cd50af72a740852bd0d7d88ddc8958360d2e
MD5 24f5efe930e582d69ff1f74c6cd6c773
SHA1 59a3d523cdf90ad5dd9a71792018d5f8b18113d3
SHA512 097a666e4cb9c799942f47862e638106015a464a017536c69518fb1ec6332bac267e0631f5ea4d3d9321bbec44252926b377b135da41140697528983ece52c66
SSDEEP 3072:K8F006IDUefOkbrBXMubuxTiHT+g+ZXjM4rTmN5eWvStRNoV8cWK7XF+TwM8:KI006CUe2mMAZapVJrTnGfzF+TwM8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 183KB
SHA256 c10145091c85ad839a394b13e5519825ea8d6f4f7778ea7e1c0301922766ddf6
MD5 438c92c8fae4e8aa00964ee0362a4eee
SHA1 aa1251657e2da6e9ee2093ab88da367c0a09a70a
SHA512 fa1ed0307e1c9c7bb763d0f21b5efc9af99306d33b3da2495bc976bb678f54567061a9a0a711d031d4812d15cb281ca11fee488c19bc6a6cb6209f097a950bfd
SSDEEP 3072:/8F006IDUefOkbrBXMubuxTiHT+g+ZXjM4rTmN5eWvStRNoV8cWK7XF+TwM8:/I006CUe2mMAZapVJrTnGfzF+TwM8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 184KB
SHA256 035543f084e155fc1ff27c31bd70c5a2b3d8462df03789aaa73f270f40437c06
MD5 00fb82a89a16e702437f15fc25316c30
SHA1 799e12622ac955019eea494a80c3edd66f2d9d6f
SHA512 88d63a49227adad58609582fd1135c91ca4c070a0f589a7c6aada9fdb3d0338077f41e3daf935354af910f0222c610586477d4cc3e4b50e463c17ddbb75651d7
SSDEEP 3072:F0b006IDUefOkbrBXMubuxTiHT+g+ZXjM4rTmN5eWvStRNoV8cWK7XF+TwM8:F0b006CUe2mMAZapVJrTnGfzF+TwM8
MD5 SHA1 SHA512 SSDEEP

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
MD5 SHA1 SHA512

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.27\autofill_bypass_cache_forms.json
Size 146B
SHA256 b6c37df977f149c5a444c72ea4469ce666c7975d34c6e2e0d9d8ec416f57dd44
MD5 9357a694006d8bec3d0f8c9607b76ff8
SHA1 6335ce691999ec10de742cd07d074eb648631259
SHA512 87c2d0192f3a78b13a691cda14da507f260d13331b792eb973869bd6dbd0f207faa48f68882be691641b46c06ed12ee8b9728a3b596df67a1f9a4831b4369a44
MD5 SHA1 SHA512

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.27\edge_autofill_global_block_list.json
Size 5KB
SHA256 088e07dae9ed4c79c840f517eb3a4d494ee87296ad463d350759cced742425a7
MD5 901caafb70b591f1da2293af10f97ccc
SHA1 e511451f4732e9266b71cb11f23dfce801a3421f
SHA512 1e302fd46619ca3ef5093612e30d863c8ce03b61664eeb9c6158efdf7145701248e20ffe9d4716556460f547fa8c7440e201ab381a9d8c4ef88e6315720b824f
SSDEEP 96:mstL77CC6fQinLk252b/lF4NXtKK5b+QiG2ZwOSZqWqxtxpttx6lFuftdMsSRa4K:mstL7O9FnLk25+tF4B8K5b+QiGoztWuv
MD5 SHA1 SHA512 SSDEEP

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.27\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
MD5 SHA1 SHA512 SSDEEP

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8ba1fb8c9aea7b71f0c39c53f14020b5770c782a392c824db736266c43ce9c5d
MD5 c243fddb567009ca7ec3fed83ea155b5
SHA1 1235e855536d2f197fa3212c2452f83de4709141
SHA512 b09e5b474f81dca85f00fc81d65db36a399d87803c4bc708d495828576adb8ac1e8f997624f4a3632fadf4d6186ea08f984f29078edcf8171011b51122e87241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6a8c69ae864bbe1337d4458508c98d53cb280ef4daddd0fb9eb3c76d8d4bbef2
MD5 0defc964190c70e1b24fc25933f66178
SHA1 b00cb68f81ea6c7979aae5c7e628f17b40d4c699
SHA512 4d9d6865858ea184d37efa399725b297d9ab6c2117abab4db9cc708ebcfb421bb1c63d4d90f0c22e4a0c6792c32ed19c0c1cd78395c0de0f31c98a7b7dbc41a2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c806fb8165617a963ff477113ed4764314a3a95dec5636fbfe43e77a8ae94ff
MD5 b64b527f9034d65977b9a710f4f24fb5
SHA1 f1bd7ff7bd9bd8e9323ba78b5d598c5d5c66cc0d
SHA512 df7dbe112066c831c2bc1ea38d0e826a5fb632542ce27203a4cac5491b132766dd758dc700f0e3f07b43de27b5a9e329d084a61cb3ffe747d926d6268d036298
MD5 SHA1 SHA512

Submit Download

62fa5188-6762-4f12-9c81-709533cc8642.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\62fa5188-6762-4f12-9c81-709533cc8642.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 80KB
SHA256 8d5ebd464dfc60817f3f0ce3997bd42d4179834f77b418a47399938392b10536
MD5 dc5c298bc9388d9d6344a34cfe842274
SHA1 ae26fc086eff068391fb26412b66fb6a139fa083
SHA512 62807191148108b242e82f23a3d620542d779fc036fae4dd35d00473b3be3d4d9e16c187b127a652f187fb9df59008e962c0712c16576e5b0dbecb375b6d17b1
SSDEEP 768:U2pmPeEtcrWDkM71w7xfOgBz0fKGOUoiT3VsOwD/oElWi8oVsON2:1mPeycrWDkM1uxdd0oUoiTDK5bT2
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 4baa2273ea58afd42ed09ad93a282c76fdb3dae9dcadebc9421457dc5a7c642a
MD5 e5bb9724286c411ccd794d474acb3554
SHA1 436f48f6f1683d36a333a034bc7f0fcbae09dabc
SHA512 f516cf82edf584043accebdaa9e5a78b872ccdc16cdef6a44cc87212b7d304d5643095693a4dc51c8a8ef1dbbce81febb94e0b3e96fb2a3fe266ad8cafd55877
SSDEEP 3072:nCD9mvtvKAsAhsfCFjMrDQpp4L1sNmJDwm1xmPx2309ODdLqpiUHhj2q53cA:nCDkvtCAL+fC2j3PmP2PdLqEUHo
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 2.0MB
SHA256 dc86305c3a7aa024c17479790ec065395f0c555d157209c2273f9194440067c5
MD5 19c62b2cf411ec7df0c5e27b3562d1d4
SHA1 00359edcae36be873eef55bc79b4dcdffd0d8e78
SHA512 178be56110ab9382504b121bd1aeaefd8dce89f54ec65c5b680fe0d251cfd63ccc98f10734570d6e1760c530bafbff376099799dec950591f1b93361f81cc113
SSDEEP 12288:x5SFvcB8zaUzRW2cfnVIyTAz3OjNvPlgZokZgpXs:juGzycfnuyTMWPkCpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 12.0MB
SHA256 e46da6126d8800c9344bd7f89fa24a9a9cbe4865772e3fcdbbba2578d23f7151
MD5 6f59261dd67eddf6a01358f84fe8b818
SHA1 937c83013917fe88e66d3808e3629d0d678aa71a
SHA512 b59173df483cd56b1a73de9f88debb2c044e569b104ab768c5fcb98833d51750070fbbcbbc672fde11f983a456bf58eb962b3218d66ba3f41b7320ff2eb51887
SSDEEP 49152:t0RxNRlmM95Zw56xRNWcBl+TYbmN/LlSD9lOxfNRxoEmO+z+J8Efr9g0x:7CZhtBl7KZID9lhYTD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 71KB
SHA256 b0c88cdd4cc230f4e403cc0cbe4f733e909a7b74b45573cab985e9a95912e543
MD5 6eb28405b0734c60579e960bbbb231bd
SHA1 e606422e66322259e672fca198ea44b7d0c75938
SHA512 5974d21ec6cdeb61d16da0511791f6e1565424155cadbe684ba60866a142c4e79ab5f850cba5e7f9668e1cf712daf495b968ef8a6b972b5b6babde02c9eb61bd
SSDEEP 1536:6Epg7p7rZSqIXabq+2fpjkG/Gd8mHmp/vGOnHTzxNPWsW7i:5pshrkqIXeq+2f1JzmW3DHTzP+7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 322KB
SHA256 968ff6a7a269d463b3e6960aa4ec04743b13d6997993bcea2d0e1842fd565ff5
MD5 6da8b9b3fa935333ab692ea8943a30a0
SHA1 fbd115f14307be1a0b1a67ea152fdb5f675047c7
SHA512 1026b0c7996c79efcd7484c3bb7e749152a85e5cf7d02fbb3d3c3d3224b3303c5569848997ba9cd8a4e80212d695c211b4a25e0a69bbdea71b365d541c44c3f3
SSDEEP 6144:Cz9kk2ab/QLRQ9o35qzxYmo1I32gSwdi0FjRT5w7U7nDEw5DtCy0lbd1:CzprFuJySsjtpDE6el/
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 78KB
SHA256 ef647bace9a14c3e848827fa4a95cc9917872e1c3600898e0d3c9e2610d8d103
MD5 67414fad18bfb50ae48a88e9565c6ec0
SHA1 8ebaf6a6bc370dfb27230f22be73d536834d1b9f
SHA512 996ef0f12ae6d9cb811efeacbdc8a338b460ad601a4191fed92813959670dd27efab4b8337c54b3eedfdbc9f3cd431aea1d738b42b46359fd8223d40b5c7499d
SSDEEP 1536:x9r1PtnMBLA3JJgT5yyc0/djDYU2Mog+jSemEKuipy:znMBg7ghc0/9YU2ModSeT7ig
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 108KB
SHA256 583729261f9b65c2be707ee36e6d54843347d8ee34d7d4bade563a74be287977
MD5 0d93aed0f8c627a450d92006392b935c
SHA1 5fb6a306aad7a219c9d5f815e2775d5ec07a866d
SHA512 ef0f90e63182b92e7f2a6f126553d1144ad36ab46572a230e3b5e9b611b767f9b284247b238a485e94c8e3bd4566abfc8e2af0e48a41f0dd975c7cefa094cc9d
SSDEEP 3072:MaL+dGIKwBz4lh/sJiKtwckckg1zP75q94Iy/Uwv1WF:MJdKTXKDkckoCy/dvIF
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 86KB
SHA256 3bab86459c2ba872634f2059cdd4dec18de06057cb81a05a3ceebf8996cfdf14
MD5 1d34e5c1741e946beadf913910718e9f
SHA1 8a1d0021b0f17bc486a79cbcfa4e44f84d5cc139
SHA512 03580058450aba56007c76071c9a1b3ccf743e35ddd75d12c4989c34fd994c0bf868c0b97b03677d42f692a35fd186b5066b1b6a902061ebcd95668a964fab73
SSDEEP 1536:41t5tuXg6C2wdJ7yKiU86wTJuELNyx0Qr0T3zP8T38kJdT3F0mM:45Cg6GdJ7piU862oHq4vJR3FZM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 107KB
SHA256 d98a6e5d4933cbe9f7f5d0269dff9bc53526b57d73e6ef80f7050c22279d7a08
MD5 be2eef2cffbe9364f6a490c975265f2e
SHA1 edf25874cdb84cf02a63a3560065543947ceb650
SHA512 7195f90a10907aa92d81d91bdc54e70d4059ce9ccdf1aa9bf52cdf897580562e262ba525526109aea423b37e2ee215b9319538477f306f0f58a6b4f632552b6c
SSDEEP 1536:oBHKygAA+3ciK/ICSftrW+lbJmKw7QCNTMwsd0FOt311YTYXuQrer6SaQeXj30Lf:o62s5/9SfQCbTSn6ww0Ml3yr6SPIjU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 66KB
SHA256 e16e6421b8bd76afa5b3734d116ee58ffd63b0252480875f2cee5b810f5fb1ac
MD5 03988a018185ae55f24c4a74bccca5b4
SHA1 c8836772cce05e98d1ad3966b469f6f2167b8dff
SHA512 f3ec63b33711f5956cdccbd13bf082ea3aea492dd7468b22d88fe1c8a4c5c213af449725bcd2e5f693b80e96a30c6cc919b1f58a39d3e509129958eee007f8f0
SSDEEP 1536:WzbRWUuFd2nmEYP2viSuOEpQd4xSOAF4Vh:0bgQmhPEuO7d4cJFmh
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 191KB
SHA256 ee615a97cf83fd32c56547806e859a44d8c8e827889c64399a4e803c70a42557
MD5 61d5ab364cd351bcf53b3cf71d9a68ad
SHA1 098d3ff809ec59e62bfb6f47b4a73e204bfe7875
SHA512 12461d320bc18689666938ea1735a4a8cb4703b04864834ac60d0a1f2048f484ce188d0093dc179c36164513dcd5bc6aa274421cdf06274733bbaae73d3abc8d
SSDEEP 3072:NXWi0E7enFZeDVJ0SfGAoQ2N+N+RpnkPmxnTYMX3WLN4dZssAxuV3/tSnqy:NmiXePwVJNoD+NikerHisAxu5/tSx
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 156KB
SHA256 5c81d4e7d5b42f55745f56c80340718ff13db1fdfa37fe0e662672a050b17b50
MD5 9fe67662dbd3449846a8f8fcd4b201b1
SHA1 1b2145420bcf97a0a0a8f8a814b4a2897b93a7b6
SHA512 f5a203528ffa156d961ee5904f06db9e4eb7bacd7be9caab18c11f05ac60cd5ab6b3ef87230d13ec17e7179ca6fd74852ef6a16937876f661cd2a68a4d4f36ef
SSDEEP 3072:RvxwWrxYjmAUryeWRJAY3yJ3GHjrufIosUrwSvfAABE0TYUl2bObJ+8iluJxYSAT:RJzLTYJ538GHLinA2IbObJ5U9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 70KB
SHA256 3ac2e84a978cc573ddedec9a075a3f70677267107705be879bd9f3b0d040751e
MD5 a51099f19c82cbbe9644ea185436f2e4
SHA1 70dddfbcf5b7db0dde3e6b317af794d68e6cb73c
SHA512 5976e95abc4c764d25774f1a6b82e4a248882b75aeb4cf1b49c549270aa32447d79b67e37e25967d5f9d0887bf037a0cef09bd36a2c4a3417ddddd1d91c025be
SSDEEP 1536:WbyEcsciE0wZVoTLnQIfYYkAN2v5taKCnsGCt7OwQssVLSboSP8MT/t+Ngt7:ecsrwZ6fQIPkANoFOQ8E+SqSlEgh
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 68KB
SHA256 b3f1f7fb3d9194255bdfa9024c88db7558b3102dd35b95a7e6a46cae5c476b19
MD5 2aea4a78f91d03584bc1a0cd9fde58a9
SHA1 206194965552b7710c2bbae795e522b3ae667df7
SHA512 cb6b68748cb9d0b518f4c9801cb253bd38900b7a1b7907b8f8efb7150077d74c0e6e5869907ed1742e7827ad9c815575b5e80ae642a2a46cf07f1d9f11711846
SSDEEP 1536:ZAUq7RcoYCtHgMtUf76Z+AGYguWv0Kxwht30GMiuwUm20xY:kRbYi/X9GjuW8KxwhyGSue
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 33KB
SHA256 bfd0b47bf7ff38e6cc2faa929a0c5fcf0b7eb63555e340ccecfd4e0da5960d25
MD5 c0705722c18efdaa49e04c02e0280383
SHA1 e9d3a1b3b732775396a2384a0709d2c3dd08db74
SHA512 0c1fc719fe95f88fa1320740c009fe8637caa1784dc2b47833c05320f536639f3378ab8833ea863b324f033984631582f966cf5da48f2b46daee7cec05961635
SSDEEP 768:0E4Fb45lofMBnDwMLKfM9Op96ZODtI9xGth29327O11:0EGbF000mcZYtq27OL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 17KB
SHA256 d6361c6403059f5262b275e6b3460452c0d261b780ddf5a9cd90e5704293f771
MD5 a36b2b54f010607afb5b5aac1f738d3e
SHA1 fc22b2988495bd96089e8c602496cfb1cc1baea4
SHA512 3b4e5d1f43f5a7bf0e189e573bc1c3fa19b43f4caf378750301961d87ad1cbecccc08dabf7a531e9a2c339b621bf809aeac8416ab13d1dcbcb43b1523610b5f7
SSDEEP 384:UOiBQHrFt6fLBFR8Zel3OR0r8i0bERSCeOitucU2d/el2:ViBwrLOXR8Zel3q0rPZ88c5/y2
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 37KB
SHA256 5a4c33eda849675d7b511bf8f034bbf515b37d7cb329a7f5b4594e1d8b79dd9b
MD5 a7e91145f0b39c5b22f6f8e4ceff584c
SHA1 57acb302f7f561aeaeba9ce90389ec27d9b6f9b0
SHA512 6500a29d1a352a4dfa3bca651c78c8fb78b16f44cad8f900b0e7b62e211548c9688949f4b5d2aadf001bfde0ef043095bfe9e9a40e3e6fcd3015c8150e0cbfbd
SSDEEP 768:0fGcU5gUqCjsEWmhFfNJJ8qe/uMfT36taQUpBpMZjHhSULLZzH:0QGUHjZWmhFfhYvPydHh3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 23KB
SHA256 98f248e33a78f354e48abb03056dcc040303dd9f1f19254128c961663c8934ee
MD5 3238ca45ff99ed72a83b59c31cd38901
SHA1 9b0e82aaec16325eedf87468cccb3fb76445766b
SHA512 a3a197bb9a7d5e5351a5319cd12057206dd8e1692590a8e5a2d90b2fd556c66343eb0c906fe13d8d05698c72aef11186dda031d040fe773eeb597bc36652d2eb
SSDEEP 384:AU14BzST2sUQnJkDr6C44ytnoZ5+A2ZDR1tgNc/b7DlLAalyZIk2TreiU2hLkR44:Rg22bqJsS4yeZAzV1tqcD7xAmyZ32Tro
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 29KB
SHA256 85ef436ac1e8ab5974f8568349aceaa3f388a544ca9203a6a483cf6f11db7f5a
MD5 b22c01853f0e888f1d4e2d80ea3cef6a
SHA1 9ae97bc25433ea400533260f0f03c509244da143
SHA512 04353769764f1eb3b59dbab76147811104a6885997ed81a6bd055cd9cd0b304a8cf8bc7138ff71840d465f09476e5d227b8242112a50d05f2a1e71d5c0984172
SSDEEP 384:+4hmp6e/GXPmHfUNlIVuUEIQVLxLqqZ3x4/WKBrUNc7c4i3gmjYMGpd5OpTPfzF:+4hVXOHfAljtXLxJzU4cVi3gKYRpofx
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 99KB
SHA256 821e2114af429d0cfec913321ca5da85a938ed9f3705af31e1b2a92dbc3dbb85
MD5 d87ea7d2cf1a5fc14d777cb771078001
SHA1 736f6bd03a554bb13c79f0a431f4b6a73e2b3912
SHA512 723187d401ed990ead85942696ffc5c70332412f8693e1e80105605c5dd905d971fff3e9ea0fab5730078249593310eb65d27037f6659bbd0cebd7e8ce5885bd
SSDEEP 1536:wsgyT2Gj+WdY+ADHdvYmAR9ZvFcD6Xcnh+bOcOY9gboIc/t6wwIWs2cq4yEovNsW:KS+WWdvZmcD6XE+W1mlCt4Pnc0n4h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 17KB
SHA256 7beceab7e682c794f270ac5a95348192bbaf65decca0561755b02e6f40db5885
MD5 ac3d43331eed61278a1b24ecd81af776
SHA1 702fa9849e7903e8935257090ac602e31d09c3b3
SHA512 d731473ce396028c0ce7787cb0bae4158179cc8d13b9eecc29f4f535b8f7c000119bd23e7482dce17f130352018fe8c860b181d581f69dbd906b6d28cdb8763f
SSDEEP 384:UKWCK+cY821dgMhd8XelhXmb2beO0YPKfVUGuFnJjT:7cUIMhd8XelRQx9UBT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 380KB
SHA256 eb30e3ef1b8269d1c1c2bb8d05dd02ed669715454ade9ff0511ec390ff035a32
MD5 3e781a46f56acc8b01d3235ba6308f06
SHA1 e913a164b34ee7bdb67d496dc08f9aa4d7814847
SHA512 3c12ee7eb6308703d0a63ef86829c19cf3571590a0f666ca24f583d8b9e4b6c4ce5b5b09e561af87587bd5653c7eb205fe1e6e55e70ede6a3febed67932d98cb
SSDEEP 6144:ORgUIxbNkdOmUKmAaN1UBbcqzauKixQy/Tjv0KZWcvFr/YEc/PRelUZO4GF:ORv4k0mj3aN29//Tj0KZBvFrwL2140
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 128KB
SHA256 c38e4d04f6e72e2b37c690e2e7de10ada276e3ae844dfc87f65654690bdf9f93
MD5 49d3596557dd58eda6d2c0cd74c698da
SHA1 0a6dbf1453a74e3dd995257dddd5876d6d7331c4
SHA512 677b30deb46b22c6b7ca354545cd363f5f4e9923e25bf3e00aa1b875f5281041e27d425f728f081b19fa79b71041f53459161cd1d135a5be0f5637f832c60f97
SSDEEP 3072:3zOywd5ARiYH0xiD814VI12YscQzYfhfj:3CXQHKiUaI12YspoV
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 34KB
SHA256 7278f9812930cdad0c816a3f78c7fefa53a818687b4e7187aa95418369240556
MD5 375fd0d880d30fe16520b0de71cdc0ed
SHA1 b163bbd5326f302ce71f5cd8eff609cf5976e92a
SHA512 ccd80d854ea9176b7c528c8c04a661a8bc66df7f85ac4cd716d07d1e432a36d47af5f78a8b736578bd2360c0533dfd38e9926f7556194c6b45d55d7402346839
SSDEEP 768:1uGe0hN1C7kTxSiKo7eJ35MDr/NcWDp8jDAZa7NXHsJi9nK4z5gXdk7bSVIotd:1u90hzwoSiKCw3uSMp84Za7NXMWSdk7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 100KB
SHA256 5682c98effece00491be8227ae75e3cfae09fb3147db1a23827bcc45dd6fe392
MD5 b9458d8a9a334ad0342ee4d74f8187db
SHA1 d7333a8d13e1383b4537a99526bd0b46f1fc3b28
SHA512 bad64ece9db02369d73f81ed8a2ca6c8929b414a2f1ca9a878eedcfce12866050bfcd313026d730fb978388162d0feb516c316d07cf8a85bc59aa93c97cfbdee
SSDEEP 3072:sL2Z0/CW2loqicfuJxk7JMCUADxbZulTJa:w2Z0/CWEoq/fQxyJMfQxNulg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000d2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d2
Size 167KB
SHA256 239e2b3fa8840ff78df82ad8a000e45d819d67cf3e2e235bb85166a5c1b31be5
MD5 4f083c721083450e342bd97c52193f2d
SHA1 12967906b0047fd1ffb9e4af2cfe7b3568f32986
SHA512 3902b8e465089ec3dffb060fc56733ddbedfadf0bc5e89c041dd9337f3fb1a57c8bc6a71c2f1cbb28d9300e6f1775d45a32cc71fade04114f1115e1587bf80ba
SSDEEP 3072:SRojAPUgrfahtJhYwEGbUdlLAavZ4F/k3St0Gn2rjUmC08AQ6iIywShPewA:2ojqUgrKtwTLAA8/k3SSQ08AsIiZewA
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 ff9fd6de6e411d1994a916121d6fd33c9dd981656f6e525e7a73aebbaa9fabf5
MD5 14351e3d1c24047cbc8a3e0cc8beb36a
SHA1 fd7f4bc68384c0658e848c0cf4663152690d3b58
SHA512 c903701b24f66c8145c7fb554b36c30cac3b130a6dea283ac2057e5993ea7336dcbec4d8b72ab30449e19bddc19509d8623e7c11e180d92ca4ecfec06cb425f3
SSDEEP 192:qaAvnM5hiEiT+X6VE1GripNQCBe2kylkl9:V5h2aD1NNQCBeAkl9
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 3128ee0dae3cf0428e2900eb732428751c114519cf24d72f7a242abd2e1fcdac
MD5 b6eeb7121b19a0f0e35df9e0c5b2b1f5
SHA1 3139b29073ee143681c0e502cf856e70b01e98cd
SHA512 9cb8ea845e909a67391c98f4c35e534b473ddf47ddb3e6e772961a76b821b783119aa969646ec5739ce9cc91964f4b5846df69abf715f5756d6875a5399b4d56
SSDEEP 96:BqxKmg1FnajhmkiT0JdwjH/Vjt7IBMEE9r0FpaPWLrf2h3ev64nIhTH6pZyl5GbW:gAvnajhmkiTOaVjQcripaSCBeo+ylkbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index~RFe587896.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587896.TMP
Size 3KB
SHA256 b66205c8d76b1bed6ddd18d041985c520bf580827c96b36cb3ca37710dadcfb8
MD5 e4adb3dec617b71cda202dd6f3a0fa9f
SHA1 b26d1d56bf679b1d290d992ac398ac4069c5abc8
SHA512 e0c6199f3811ba52ca31e49774c43a2f20596397af79d2b1e6511d02ca4eaab8569ff3eaaf5633731cb3530bb1bc6eabdd44dad7b7c3c77ef3a16001748af041
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 192KB
SHA256 e8b66f982d4a5348e46824c0c62261997983db5236e6517e6b51a7ef4fda9a29
MD5 df2ae309cc937839ecb01325448dfdd2
SHA1 28de3a5236bb9b93b8691a31f06917d46f02af6b
SHA512 c4ccb3705a7db0468c309895277c92a1f455d610e3f0536b8337aea232c97f980da73929b62c2317e89730c9d65f60ca01873eb98bff9b3f555e985d03dab805
SSDEEP 384:YKro4+OBE3u1goxRFPf/A8jTymUuv6CGm:rPBjbu8E
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 dc2311ecadfbd2102577a1401ee7eadb0183cc736b069840ccf9fb0cb3b2e7be
MD5 15905427d2e3c6aae4bdf2ad791106d7
SHA1 9664b4aa599e64a35aa6b25c57f808b987bdad7b
SHA512 38312f789bce3b3768a29b19c2bc6d329bbc8a0bf27798579be2ffa38d40dd8147d99adfa83c2ba15ef1a72f6fb9d416e96f781aa1b43f932ad0d5977cebe26b
SSDEEP 192:D+u3fK06M2j6duPKQhwuv1Tvk81YTzLeZZmT:D+u3fK06M2GduPKQhwuv1Tvk81YTzLe0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 e8ba85de653cd78226c337be0e0824df4cb54ef15d7f0b8587791825acd31059
MD5 699f83e2c12e0c5a2b4ef5dafd8a1db4
SHA1 df259e27a2395b79fa14dadf4e0fb1a78d9d32fc
SHA512 bbb6736c9e092645dfb4ede4e70af35721efe29c4debff39ef6a9dd1b9c7e0c80ef26367c99d8ad3f7aea304903bb15749faaa44ee119cf81b5debe0c3bc48af
SSDEEP 192:D+u3fK06M2j6du3Qhwuv1TvghKzu1xlyx+sTiM:D+u3fK06M2Gdu3Qhwuv1TvghKzu1xlyF
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 89f71d6cabe5b56afdf89067f1c17184eb47f10f448d90360da8908231612470
MD5 55121dc98a18737bc0395457c008eabf
SHA1 77cdc7928c3b26c3629742315489e2410523b5f0
SHA512 6fe5ae10116fbac6b32d5115d16ee283bae10e4f74a668c6590dfa6a5628053692a63308f1a1051c7ca35e7264633c199b2a873a1bd293a334d89ba2c598c61a
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 e666ab42c810dcd91b87a17e3604d2299b380810bda9f1dcd733bebefd0e0bd9
MD5 03fee2760aaf8434aa2196dbb208e457
SHA1 5c4078a87534687c6ae11142944eefce7c8addcf
SHA512 34e72a23275f62693fec3aeccc1fc356b3e7770a7bf58e5192a0f0660b220497b9cafd9de45c1658bb9d1dbf450e8e07b646b79b3a1dc7296f547c6aee650957
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 5daa68790690750b96114caf5c5bdc9c2414d886537ab82c1d2d985a7856e126
MD5 c5ef7ba5ca0d3e74f94f6e4a6889d867
SHA1 a13439f00a1e68632eb981159191bc681fc38fd7
SHA512 38f04c21a4aca920cbc581e00be539c91e9818c912044ef537cde2292572b24aac7746fb55bbdd089886ddcc5e5ba7c1d14e44a5875e9ba7264d8af0a0799e42
SSDEEP 384:sV03+EPTm1KaseMF5Gm/ziS/Sfxpw0EYc6:s+zm1FMF5175/S00Eo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 689324a9603ae282d5d18d770f35b2bf45c08301c9adef31dd70b75dc3a8579a
MD5 1154ce52b10822acd64b284958904369
SHA1 861fc29e88850380fa915ad6a7bd846d5a7e9bb9
SHA512 d2a64adec4f5cfedd0012513138d758996546cfd2a30c8a011317a8f835041cbd460c6387faa0b84fd989555ea90970dad02fce7329db988a2fb6ce2c1739c4e
SSDEEP 384:sV03+EqbTm4KaseEWcSF5Gm/z56SsMoDZZfOF/SQMjw0mUco:s+Snm4FEzSF5175OfI/S+0mC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 dfa5fd06f4e46742794c69393460de5f1f4a4e38a4ec9239c27a1e9e64e0d828
MD5 013d72524305c7e1a44e71c958eaac35
SHA1 e7b08812d6f76762361010c59f99da0516e47297
SHA512 1a3ff5f2ca7d65a77254173ceb7d2c78115bcc75057144ea93eecb5e86583c3d083cbae0480a56f08664fcebc558bbec419570ea54588bc0138c805822ef7433
SSDEEP 384:sV03+Eq5Tm4KaseMF5Gm/zN6SsMoDZZfOF/SfMjw0/Yc6:s+SVm4FMF517NOfI/SZ0/o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 4c99c369421e7a2e3fe11edb58d061a1516fc86e0b81dd4b8713d82734d36270
MD5 ae368889c37bfc9c1533e45883f820ed
SHA1 92790664bf67a623e9f82f3dca1cb720bbd9550d
SHA512 02bc8b111861533b8e2d7561796c877d65edf5a72ba86b6c0a2d2e6908d5e0bff6b926f373be602e0626aac3a9fd0bdd6bf2dd0847433dd6300351985a1c78ce
SSDEEP 384:sV03+ZqbTm4KasIWcS37Gm/zQ6SsMoDZZfOK/SQMjw0Q6co:s+3nm4VzS3717QOfp/S+0QM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 b1d09d941c318d82da0df30a90f8259bcdb65b3d984f9e24c0e9dfcf79d86035
MD5 90f257baa820a6ff12ab936cecb459e1
SHA1 12495931f4ff8cf20cfa76d5696ace276fbf25bb
SHA512 6a7a041c1f7ffc0c5e3b88c4ea3b3f8dbb23fd865244d45f5c111e9f93169deb3c50656c3669c7c6053b85e74fff32ef7e48c9a75c10e5877e196bd105be19ac
SSDEEP 384:sV03+ZfoTm4KasIWcS37Gm/zQ6SsMoDZZfOK/SQMjw0G6cK:s+Gqm4VzS3717QOfp/S+0G2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 c98a5ff426d8fb1377cc9963b7e931621d5a57684844cef49bbfc35d21efe840
MD5 bddbaa5dbece750e63da80ba91979f1e
SHA1 fcc2b8a51f009cd66c88bbcf3b0d403430611523
SHA512 1df542b4c4c393f744d8377b3f6f1e88d363fc7fd4ace165c26c8b1fa3f70e8e12d040fa5dd962893b8d7309dd56577900353b89cc7c53a096f52d92512cd3c6
SSDEEP 192:sVjRRVyMqv/Ky0hl8M3PKase7fNhQMAm/zfpfsbKzChoZ8prZl/Y+WNnMhZHkwYK:sVj3+EPPKasezrGm/zkL/Si2w5rYcB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 068e6ac25730afbfa54620f1b5712c2b978421934b32d2e2a62903ffc6caf112
MD5 6302357e7f3f531069110ba8df8d21b2
SHA1 82fa09d6505c997ff39a949ab30924b8f8c9da19
SHA512 189ced13a1a80cb23ece9b0fd86ec38677afb1573431c20ec563b9655be4c6ed9dd1725c7af39ffde75bcce5eddcae6748fc1ef6fdc11285b537fdd092e8f08e
SSDEEP 768:IiAor8f02+/7pLmLlbbWRW/1QSK8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3puFpLlz:IiAor8f02+58lbbWRW/1QSKu1jaKpuFn
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\33d22383-2cb1-4238-a3d1-4166f36ad4e7\index-dir\the-real-index
Size 72B
SHA256 ea51146efae8b21c6037b5c8f40fb5a689874d10c5b5e0adc5869c7dd43d2045
MD5 5e2aca64e9899629e05bc5e4de99c368
SHA1 751872438c37579d2459e70d4bc4125430bad9bf
SHA512 f233235fda5dca9391059f1e1f983fe09bdf17409c56bc4dc204d84eaee4004b2a125ac5a93a56b875d5edeb10f9acc1513071c8d3a684661919c0535c588202
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\33d22383-2cb1-4238-a3d1-4166f36ad4e7\index-dir\the-real-index
Size 72B
SHA256 6d3fe94e17e20ee6690da1866aee0c44469714c95b4603b1ec1a5c543dcf5239
MD5 7d5d3636f323e5159402ffff60a21e96
SHA1 8547ac52334833dd40c3567edbf11b07c40a377c
SHA512 f1e7c555709652559dbedba471bc10a23c769b7452efba435410ecfcb8cf8e04e6ddd42a6e0d80f6938880a37b36aa16abe263cabdae4fe2123df4a52b2296d2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e6e290-132b-4984-be8d-5c9e1ebdf6e3\index-dir\the-real-index
Size 2KB
SHA256 678c64fc4f822700e4d7da7e274cd8f992b8d6a7646833d004abf955c42f8227
MD5 82531fdea93a7f29729f50aefb25d18b
SHA1 fac1137b59e544edcb8e01b3a4ffadf6d3338a6f
SHA512 52d29f3cf2a2b079575bc3e52ae3f41e64f0a78daa75c2dcc340399009d9e6cd31eeababa80c8413922d9b509b6481ed39096a1d836cb8e20da61fb7a599e102
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e6e290-132b-4984-be8d-5c9e1ebdf6e3\index-dir\the-real-index
Size 1KB
SHA256 9fee7b80cdeaca1ae3b7285e97665c03d0d24b0e9945af66d8d1ac4182b5f967
MD5 a37692d92c026714bdcd09b4d332c55e
SHA1 2922ac3a3dc38c9d14b1a003f695f1e7c9e14e75
SHA512 fb352777da3f6d9490434e2df090fa5569b93c62e6323655137cd4fa33c786041d1af79afeb157b4644529d5b51de90ac9b734a09f9d421c8789971e20ab5a78
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57df83.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e6e290-132b-4984-be8d-5c9e1ebdf6e3\index-dir\the-real-index~RFe57df83.TMP
Size 1KB
SHA256 1828fceb8c1dc5fb0dee9b9f27ddd25cad85d76755a32a4dc3d57bb92cc71538
MD5 bb503871f2938ab7242b7242239b4825
SHA1 e115c9aa6aadc3077aa062a48735411b6911c4b3
SHA512 2a60d30f5c45519e690607f730d4f7e2694c16f590909c2c4836500044a2c7c3d15052f8b93092f88103c741b92c33d79b9763dce3b8c46d9a5d57b87f0c920e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ac5bc188-fb57-477a-bbba-1d1138b09194\index-dir\the-real-index
Size 72B
SHA256 2de6d62f108e29e046b4561eec458b2db9c0304afd2397930995620ecd4e0912
MD5 c765ffb23c2c1515d8b9054bdb8bf4c4
SHA1 7899e203a5bcdb2ffea7fc4c702adc32c7ddeb8b
SHA512 0ad93d9e14c2ba9f0b906862cdbb33a97a62e98d8913a13a203529dbc1c62197d97b4157f897bf78573cdf32d536e161e23fe8a1e1d3f09b980dcaff38008c4f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af1cb7d5-0f2d-4078-b59d-545b5e19775b\index-dir\the-real-index
Size 96B
SHA256 b69ea2fe44f9d13ba8b91e6c5edf8f82bd60dda390abdc7c9d164c1c4afede09
MD5 73db8ac0c77a5626412e0fbe6f20e08b
SHA1 b041ecb18dbbfe5d39b05dedefbf331567f8cb2d
SHA512 f41cf5b3ebfb1f8a9e333e4d19a6cfb0a30541ce5078a50fec3f34fd44e4868f4a375bd4cc7233b8ac2df939650a6715d907dca20dc70aa0876d35f848a06ea5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af1cb7d5-0f2d-4078-b59d-545b5e19775b\index-dir\the-real-index
Size 120B
SHA256 fcb35caff489608fc614324ccdab2f29993462ef17ad7b0ecc85ca01d790146c
MD5 fe8dfc4ad246739904787a7508d798e1
SHA1 bd8004f5f813391e2ffa4935a5d4556fda8b8f7b
SHA512 8e117e6deec6e188bebb192f53a6423486d3be73e741048d86fbf4c948c16c349e4923074fc481ed66b897107db572468649620843740f0f7874c511e763271a
MD5 SHA1 SHA512

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 322B
SHA256 d440efc6675bae46fb6fea0fa370d9eefb0dc0131193bcfdbd893bb1fe8073d5
MD5 4a60d71a9595397acd4eb55951d04e6b
SHA1 28cc1a1e4d98171e9ef059e232ebbc5050259a3d
SHA512 f96100a799fa884e077fdc22f172574d54661f2658d4db09a6e8aa9052194bf49d8c2eaf98f188e814a1b6f5d5284722d99651ebc9fb04cd8a6c21103fece638
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f3614b32218ba1ca51a27cf0eafc2f6b719ba83b0a0ab26ec609843c3e36904a
MD5 8e2bf8f2cec2c7c7945091b5eb138418
SHA1 aa0368130ca995346c6b2f286d33bdd9cfaf7e3a
SHA512 54a791061a0905ea7c17b6e94002ab119687a61a0f41c14a1490602b1fd3b05d36d18520baf9475c3e7905ce0e541910e302e28494781c9c08283b6e18685728
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58365d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58365d.TMP
Size 48B
SHA256 bd2d1a9763ba90b1705e1fc683326e8eabf529087b9db9221cf53ce8ef08c78d
MD5 9346fa469261ea8f68873049dc727779
SHA1 24670b51a333925dd37d7c96daad7bc640f0f7b6
SHA512 50f66253b8eca031795f2874518ff9cd50b34418d9ea88a686a8966347b8203b520ba6b81e772d3ea1808c98ddab28f12e0820e0168089998371d716a336b56b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 b9b4a52c9dd5835ccfd3e2a924f25f03683427fc9c28a57fc5bcb36543598e4c
MD5 3c2b5ebccb925515b66cf7c19843148b
SHA1 14de2f80bea18c3612f4a885cf06727603528eca
SHA512 78fad617c0af822c9769a5e789ee05ddfeb2cc4b355244b6fdeedddb8afafb5dcd35880615fa47c533bf5025c6ae5efef41d2d738f016e03361d1238109f11e7
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 d9e60cbe7c2a76329392295fb787b2c214b38a46aec9700ec599288698dfc8c9
MD5 a1d229e1aa6bc8ddd991f3c5ed0688cc
SHA1 702eba7cd0d5f390fad943571366b2070b1148b9
SHA512 c059a36f16b08eca6840882adc981ac7c35f51e6aaee837571c77389a4e288a7ed88eb98e884e7faa871b5eb7d6384056e91c4363e5f0855bf9ca517699ee982
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 950cc8dfc82e2eef57b48254affa9a2388e772cad7dae5464f27f8fc9617ff4d
MD5 dff05fcaf78c9e696c8db8ef8d9f6ed4
SHA1 c9782137759bd855111d65c511dee4cafc73b195
SHA512 435ce640976479704b0e3e937544f7baaca2e6d166cab7bd42aba112c64795c11803a44ed003452b2b2dcde336ffbdb7da16495adb4a7b1faa41ae0edf4b299f
SSDEEP 96:FxKjuSKGnK/WmKyoKd6vKLrKnWAKoNKz2WKWlKLKdK9FKjugKAfKnanK8VKDqvKx:gu7kEw2urB
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 460B
SHA256 1f8b8077fd7b0f4ba96ac379f85b84b67f7df17375ea5352650436046e796c33
MD5 441edde8296ead62342e66b2369da8f7
SHA1 454dd90b810ee9b72210f855ffbee44e5d34d857
SHA512 d208efbce56a8ab41f8e0ca11ae35c99103826ae5b085c14004616a3505a04e2320326e321f10f63cf6e1962afb99ca61f7b0dc429d743c19cd8b8f3d9ffb0f4
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 464B
SHA256 2f4e9b3de2f907217c486e56030f2931e4b935e5da49409ff0e9cff6b749bef5
MD5 00c26dcf33131145b3bbe48d8b40dd96
SHA1 f046631355a8ef8c9f2a41f7bcc0a90fa7fc2836
SHA512 ad0ca7b36cb598c73bacb12d378dd0e486799ca20baf2f6b457ae35c2558f3395367df08751761e39cb7ef674a1d1d645b13a11204a1c6ead6c81d5651c05287
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
MD5 3e45022839c8def44fd96e24f29a9f4b
SHA1 c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA512 2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 52KB
SHA256 992e1209f9c3f3e9dedbd3b366c60d45b8aa8f2d3afc82c7976b5a6a15aa476d
MD5 deab3e1f356eeb5bd947c401dbcee464
SHA1 6c6ea09ee6a7e36aa00bd4282fd6b33257c68511
SHA512 ada64377845eeecfa822b255c3da554bb818d07f0f6977139da31af0fc9f97cc6775b80cc869104c1b16153c48dc7aa2d8852991319911e64d56309ef1242d8e
SSDEEP 768:XFOBRE+D0tHVw7cX4Cgt4Q6Jiz0mqBARr3QpKjP9UlUlNfASGE1covGqsW7iIKuk:xyIXs69Ad32KGlUNuE1cWGeiA4b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 3f29a64981506e5d13f59899a29b01fa73f66d441b24b4c5ca6a834cf6b06264
MD5 a3199e6ad83497259f11d1e18785ef75
SHA1 0ecc675c5f41091e16c9886b67d9fea7a1f9b6cc
SHA512 6a8d3b64d35d76245707c0aebe036fa5e55f285fc61e7a6962df9e34286d0ddc6df760a7fe59a08792bb5786209bec0570148108c0d3b4b0595d8695ac067e5a
SSDEEP 768:XF8BRE+D0tHVw733/CgtBw6Jiz0mqBARjUlNfASGE1covGqsW7iIKu8U+b:zyL3869AtUNuE1cWGeiA4b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 52KB
SHA256 bb175cab35ae0e72f03acdfeab4cbef8aaccc345b5e7e49cc3a2e70649d0b4ee
MD5 c39fec7067f1931f7f1c6b6afb0cd75a
SHA1 db88f4e91f21a3ed3369054e74e27ac798ff5753
SHA512 ff2678b1b52027cf0dd733a2a157aa9c0d3bd31d3c55f3077cc03395467e67605e3581c0ff4f3a305733f99e5a06f67af15732525ddf0d2e30f09762bc4240ea
SSDEEP 768:XFOBRE+D0tHVw7cX4CgtdQ6Jiz0mqBARr3QpKjP9UlUlNfASGE1covGqsW7iIKuk:xyIXP69Ad32KGlUNuE1cWGeiA4b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 615df4a3e34d0ce4ed0bef7fbfc53d4bb8fae4f9a29cfb5b066fc1b206b2aa76
MD5 4b5e355f5b76a12bcb49be8e0a3b56d6
SHA1 cf7cbfa7cf7cfba7fe5ef1265607772000e95564
SHA512 27fcb86c476313818161b58df5e47882a3ec32f316e828a7d76f0a52792c55aa5412e3cbc149607b2f027b5a9a349864783af218cf6edab74e8ecbca2334b443
SSDEEP 768:eFOBRE+D0tHVw7cX4CgtzQ6Jiz0mtADRHsplNfAS8jGovGqsW7iIKu8UZb:0yIX16e0RHszN0jGWGeiADb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b369d1344c22786398b9722d4455be69d0939110aff7a0914d61610c53bdddf7
MD5 f64eb057dfb05f4f723c3b0d74d8d2d0
SHA1 7bfd49301fa186e230a2014d3a1b9ffaa22d6ea4
SHA512 3ce9ddd05f2ac2cbf30cbe3443e6ff354abde07d2ef620cd03ba55403eab7c900abc4c1d7895b5910c47222514211a6bd9a79cda9d0fdbbf30a9aef050450e99
SSDEEP 768:7FiE6esE8lDldUGz3UCgo6N6Jiz0mqBbRjZovGqsW7iIKu8kE1L49:yeB85d73c69btZWGeiAHE1k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 68f438bd1b2a0b4e6090df93118cf26eaaabba65bc552b840e139c921e3b278e
MD5 95e74a3d35b392c854d36fa4e8f391b4
SHA1 ee23dd7f118688e040492cd34b471ffd928dbc33
SHA512 12144a8cd19b151f1900fa02cb3ba659ca2fc9302b96326a6338b0103f2f0b077194951ba97eb1bf57c9133236e65dbd182d6e9f3f45e39895802cf54759a922
SSDEEP 768:3FiE6esE8lDldUG13/Cgw7M6Jiz0mqBbRjZovGqsW7iIKu8kE1JX49:GeB85dN3b69btZWGeiAHE1i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 56KB
SHA256 f813698317ff33e7669ea527c55fc215400eb3a28c9809eedb0c53b9487d3a60
MD5 979cdaa85a2fc63cea6da3e54198e1dd
SHA1 408b1949046f8e10358e4669779fb276d6366a1d
SHA512 615a49a183b7a435035863138c87c1934dbd83d05c56c42543a30ef74c458cfa074817e3b0908cb17df46a8f590dd8f5011aef8d2ff57d2b0c8bf2a6d325b70a
SSDEEP 768:eF3BRE+D0tHVw7RBCgKGQjqNd08Z1NtnwB1AzrH6lNfAS8jGovGqsW7iIKu8UZb:pydGjQb9W18rH+N0jGWGeiADb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 15e45c52b5752eac63b2cb38cd7d6a91d3bbbb1f7d741348dc1d0975cff9d830
MD5 22af291a32ed40d24e1165b923bde2c1
SHA1 ff9dbb524fe7682c34e5cd362d27ae065274aeb5
SHA512 a1f2c91643d45f4e2a13e14710a248254938b0d91ed095e5fb75a6235af2daab9b077626eba657458a8b9830a763fbdeecd27589b6ec07805c77a5f29b622c75
SSDEEP 768:3F8BRE+D0tHVw7b3/CgwQM6Jiz0mqBlRjUlNfASGE1covGqsW7iIKu8U+b:Tyf3q69ltUNuE1cWGeiA4b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 56KB
SHA256 d6657feac4e493303dfa9294c4e6e97ccb8959ff442f7dcd75c0cbb1f81828aa
MD5 dd1f292c287922d0e8d95bf550a9314f
SHA1 6b82c76ddac597b8365a62519ab73286c1a11725
SHA512 1dd52838f124a73ac40dcaece1940bac09dfde5e89d6681127db5406681f5ca1b359c234138ada42a6c3e9282f464cce9d0f4c5329c32ea129a978264c70bc21
SSDEEP 768:eFbBRE+D0tHVw7RBCgKGQjqNd08Z1NtnwB1AzrH6lNfAS8jGovGqsW7iIKu8UZb:jydGjQb9W18rH+N0jGWGeiADb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0c8c500fcaaffad18c3076a30063c2515106e333600a4d9a96b906b22622d56b
MD5 a5e767841521cf480734603d066708f1
SHA1 fedb79aa8997d126f38318f63c5a100e6ded9504
SHA512 eb0ab40ee5e52e89dedb4576fd567183d8af8c1912a437e3bac110ba584be2aa3f26519c3c2b702fc7194de6d0d38f90e0ac292caedc11d4698ee15221b4e79f
SSDEEP 768:wFiE6esE8lDldUGz3UCgoi6i6Jiz0mz3KZHtovGqsW7iIKu8kE1L49:BeB85d73+j6+6ZHtWGeiAHE1k
MD5 SHA1 SHA512 SSDEEP

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1f8dd71c09f84a9d209369cbaf760a9b419e9c7a595e1a2d81ec043cfc79e5c8
MD5 e70a82caa45782603ceb48a849c50015
SHA1 f8bbb15428c2f2d2920b1e87138470fa5c6c08b8
SHA512 5a0818cf50ceece429a91211a7d01d6b2e0f90673306f8126ceb1be67d4afce71da87f1578c4e91e24be32b1fcb15fa242907c40ea09c3176486542d330e3b90
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a1caf014e353df715dbc474e0b57cda43b77916eb861a779a02aa31fe935cd93
MD5 daa90c9e90b7171d19657cfb2f54a7d2
SHA1 55a7530bdf14a59a1f9b37890fe895891c969f5d
SHA512 da393b3333992f3007bb8cbe3db9a79c1b6fd6c00ac02865bf159a324b28a625c19ba14d2ddc63afcdbaef2e7efae1045ac21c9a9685f5949ac577aa963f890e
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3ba190241d2bdc8f07503e579db685c5d4a7f70cf474617856b4475c8feb4d4d
MD5 e0b7e584371687b00df7b2f9f1096a54
SHA1 566d171b2dacd9686cb53d6f5f12fa01ef81b484
SHA512 055a7c803c73e307aecfc5de11a2a1820aae58fe466f350f3127c2e3d55cb77c178c3e6ec62b26aa4490acc137a5bc5a6693214c616b04b2dcb1583a5dcac8fa
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7f2d0fe958239bb03a3195f1acae7fc927fe2f283d999ed6ff08d6322dd9bc16
MD5 33aebf1e7d836a13d0ff8c38c88f7e17
SHA1 a579757c3f7e7608dce655f050e4b410a30e79c2
SHA512 c1759ba26de86be118e704bae5d11bcec48b5858d1b8e856bef1daf8b8ee8353cf40e45c9446b0423f51e9cce39a872f93dc15e6b0e309fe3027b055ee8c7896
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe57ed7d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57ed7d.TMP
Size 392B
SHA256 e468560d276cb6ca46f490290bdf0352f6078af366ccf82a3b8bf9283e396c7f
MD5 561bac8f0ea48b0978f8ab36b42afc38
SHA1 2f79b039b45069d80b28fdf3a9b0663872faa3aa
SHA512 2353c85c4d33a417596a73b860c178b35bb0cbb8e0165b404faf9b9c1c248c6f05ae7c7c8f4e86a38c4cc099056afb6a250406884bdac4adebc310110c752f2f
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8716a6236977196c9127764b460d4de659c2131bba2f5bffcfd6aba1ce598070
MD5 969fac6e9d8e9800a5837b5f65a63cf6
SHA1 ea72de3653052bc2c0f2f5808da796dc5ed51727
SHA512 b58f5269c6a0d34bf984eb45aaaf3200bd336c711dae6da88f9d84e28121f678ccec629a6828ea13b3d07df201fd423ca44a166a34d5899fe34273ff479e8bb2
SSDEEP 3:MsEllllkEthXllkl2zEFllB7K/:/M/xT02zC7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.9.29.1\keys.json
Size 8KB
SHA256 e5b57a8978e405e9487c43e6b0b3685c4c71cdaa2e74e25d7fbed75ffaea01b2
MD5 80068ae175438916aff814972b76e6f6
SHA1 39336911d02ae3c5b038aa31c73c4757dcfadab6
SHA512 7cd55dc8c37fbaf9675d08fd2346ee45721338e1e70cf6aa351e54b45630ada5ada1243d738742cbda258c830e25ee8e09f57fc3cf21948e62c3c552ba9cd18d
SSDEEP 192:uNtGbRmmhGfHPJyR9Pm4lOvMwkoR9PuGMXcy:Ohm+0KjA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 59bdae85374b19ef28c78cee822ad961c78c83e3616500017a076115c17d0096
MD5 31390225a4b62c039eb8371070b30416
SHA1 f2ab8dd8eeb493ada6b798ac556f64f9e8d2acc4
SHA512 03edaccc9a3e76fffe157ab5ebc48bedda57cf51202c72a8d1f4417d2466d0d91c16c443a8dd82eb1852bf8c82519221b59fa3bb47b1c65e47908edcfdea01fe
MD5 SHA1 SHA512

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9
Size 161KB
SHA256 23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9
MD5 d6a332ceaa785f20d7cf0ef7b9fc4790
SHA1 65f275d0b2d7b017fc8727298498dd43833d0940
SHA512 d79eba8bc96fe187f1284e7c3adf9323bd0525f73daba3e6f97013297588119256aa1af82ddccbdff5483b466f22b1846ee2f44afeb84fecd7f2c6951b7aa659
SSDEEP 3072:D0siC87t5FyUgTnPw2Aee5WZ/2gtjccLyD1FLrhHopoqxPVv+J09vXOj:3MTyJrP7xe8/RyDf/mpoGX9vXOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 23KB
SHA256 79b99eec0f0413cd8df8b58b19259c835c38e7a236860c7c542582051c518dad
MD5 a591ce02a7854d40f62703a3794ca625
SHA1 43d24804014ce2d8d5c1b7a0722f682197c71076
SHA512 245de1f5689056192a16dca8d70d94f3ba79029cfd7c7f9937011ed8fa058d2586943cf984fd28cd00a9b61be4d705f9cb01b27f5f8e6ed106002762714c3e72
SSDEEP 384:xJWJ5Vca12krtuJ+pmXmlJVjeQ8RJorlgghvjUUQWB5Pym5z+GDa50rbZYAVxcvo:v+5VcWrHl8RJgWgljUUQEPz+GDa50rbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3512_1908225588\CRX_INSTALL\manifest.json
Size 1KB
SHA256 a534811f18737107d8fe30c207c49e8f6c746d552eb2aa1c6c1490e20554e6ba
MD5 4ea02d707001e4a23ebca21664b5e707
SHA1 0a2550ab927a195c831e57adc419f65ce013661a
SHA512 954e655c70c75ac37a29e93ae7d238771733fb9c18bdcc306305a8bd7fe4208dc8f73fbbc23180809078e955f317645e9f3b51321bbbd3e9007de4108f2ae8c9
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

ntuser.dat.LOG2

Path C:\Users\Default\ntuser.dat.LOG2
Size 536B
SHA256 993fb38e8ecc5d7a5130b11b23e87a419af2feee0144f94abcc4ea72a57361c9
MD5 1c210bfa424ab63e6c959d80389f9898
SHA1 2a323bbc2d2f096ff1b3cd4729eee7b035444e5f
SHA512 f6b85f2a38cd771a2ecce567d7a9447ef03ce2650a113219542b040f067056cdb856b01d78fb6fd50f85e4e575026d50a8153e3d85d95ca712eb221b11965bd3
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1041538912\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1041538912\manifest.json
Size 79B
SHA256 7c00a941d7a04048f469ffb986ff7e8bf349f149639cc474a463da4a607c0a70
MD5 0726a393d6366788cb47da5897d1af64
SHA1 022ebd4d118261b871d50479868d502b797e6d14
SHA512 adaaf0c40793c606d44fd7112b42040f01dd483a7c4c678e811f824e2fbad722ee3faf50984615731d71425eb3a1e4a9090962249e673fe8e7290713c8f75d9f
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1610491432\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1623233322\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1935291319\manifest.json
Size 176B
SHA256 cd3bfb95cabb4cce04ae822443c4e7ef5c16ef8364804b3907bf37775f821eac
MD5 f99766abe08dd2f4607288031ffcb71d
SHA1 40f82d7a810175043004f10366a763180f4cbe13
SHA512 a6cde975e71a816377c2837d0941b0c7e68d730dec93d157b4171839e6a0314fb599053111b2e1951b0b90b23ae5cd06e23e7b7cbd01d6f9a6928cad82bf5e17
MD5 SHA1 SHA512

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_94941014\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_94941014\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_9846004\manifest.json
Size 119B
SHA256 5bf22e358190b68aeb3d993f5c59860ac210b397af6092e47c8df5c8858abb58
MD5 de1b38ecd4bc3fb8da1f7ea0644cf16f
SHA1 747d6d0d59023bba6ac65384cf6bea8b639abf70
SHA512 1876532f03731d127f9883703315eedab053a44ebc200218f5179841c2602ef52b69113ffc2c6cec501dd0e34307960836f0c1aa1a4a648be3dc0b1b2aa6d021
MD5 SHA1 SHA512

Submit Download

how_to_back_files.html

Path \Device\HarddiskVolume1\Boot\how_to_back_files.html
Size 4KB
SHA256 225009d8b372f391c693d6c5e24d8f35947d84c6f9776e4f743b1190c05c29f0
MD5 449c71b15aa1d30206e9dca6850b1ad4
SHA1 9b615ec0d833bf832b9829a47949fa06f39748f4
SHA512 be54dd76263ec429a92f1abdb7240cdb9fb35f9c512cb737bb0f84ccd3c75b13a41bbf694efec28dffd01b5542c05fbb5f7eeb150890eaa11fb6ee1c7d713e4c
SSDEEP 96:8y+cAl5azrn+DtZogEoD46APKw/8CxiKFe8LTRjY:8OAl0zaDjfU6bxKYQu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/176-4806-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1268-4707-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1268-3951-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1268-4786-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1268-4678-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1268-4675-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1268-4805-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1268-4648-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1268-4647-0x0000000000400000-0x00000000004B2000-memory.dmp

Download